[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fYVULMmuCE6nnjChPvtnAwhhxM797mdeQJkH3fkJzKfM":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":17,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":43,"controls":44},"e174dcea-d544-4895-a091-666ac48f36af","gpustack-authentication-bypass-exploited-in-the-wild-patch-now","621e4244-9557-479a-a2e3-9517011ee9d6","GPUStack Authentication Bypass Exploited in the Wild — Patch Now","CVE-2026-102895 is a trivial authentication bypass in GPUStack that allows attackers to spoof the 'X-Gpustack-Real-IP' HTTP header and completely circumvent authentication controls. This class of vulnerability — trusting a client-supplied header for access decisions — represents a fundamental flaw in authentication logic and is straightforward to exploit, requiring little sophistication. A fix was available in GPUStack version 2.2.0 since June, yet active exploit attempts are now being observed, meaning organizations running unpatched instances are exposed to fully automated attacks. This incident underscores that for internet-facing services, the gap between patch availability and patch deployment is a directly exploitable window of risk.","**Immediate actions:**\n- Upgrade GPUStack to version 2.2.0 or later immediately on all deployments\n- Block inbound requests containing untrusted 'X-Gpustack-Real-IP' headers at the WAF or reverse proxy layer as a temporary mitigation\n- Block or rate-limit traffic from known malicious IPs (e.g., 144.91.73.103) at the perimeter firewall\n\n**Long-term improvements:**\n- Establish a formal patch SLA (e.g., critical vulnerabilities patched within 72 hours) and enforce it with tracked remediation tickets\n- Maintain a complete, up-to-date inventory of all internet-facing services and their software versions to enable rapid impact assessment when new CVEs are disclosed\n- Never trust client-supplied headers for authentication or authorization decisions in application design and code reviews\n\n**Detection measures:**\n- Deploy alerting for anomalous or unexpected values in the 'X-Gpustack-Real-IP' header in web\u002Fapplication logs\n- Integrate threat intelligence feeds so that known attacker IPs trigger automated alerts or blocks in real time\n- Run continuous vulnerability scanning against internet-facing assets to detect unpatched software before attackers do",[12,13,14,15,16],"CIS Control 7: Continuous Vulnerability Management (v8)","NIST SP 800-53 SI-2: Flaw Remediation","NIST SP 800-53 IA-3: Device Identification and Authentication","OWASP A07:2021 Identification and Authentication Failures","NIS2 Article 21(2)(e)",{"NIS2 Article 21(2)(e)":18,"NIST SP 800-53 SI-2: Flaw Remediation":19,"CIS Control 7: Continuous Vulnerability Management (v8)":20,"OWASP A07:2021 Identification and Authentication Failures":21,"NIST SP 800-53 IA-3: Device Identification and Authentication":22},"NIS2 Article 21(2)(e) requires security in acquisition, development, and maintenance including vulnerability handling; organizations operating GPUStack are obligated to track and apply security patches promptly to address known vulnerabilities like this one.","SI-2 requires organizations to identify, report, and correct information system flaws in a timely manner; timely application of the GPUStack 2.2.0 patch would have closed this authentication bypass before active exploitation.","CIS Control 7 requires organizations to continuously assess and remediate vulnerabilities; had a patching process been in place for internet-facing services, the June fix for CVE-2026-102895 would have been applied before exploit attempts began.","This OWASP category covers flaws where authentication mechanisms can be bypassed; trusting a spoofable HTTP header to make access control decisions is a direct instance of an authentication failure.","IA-3 requires that systems authenticate devices without relying on untrusted, user-controlled identifiers; accepting the client-supplied 'X-Gpustack-Real-IP' header as a basis for authentication violates this principle.","published","2026-11-12T12:20:21.355954+00:00","2026-11-12T12:20:21.31+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fisc.sans.edu\u002Fdiary\u002Frss\u002F33514","exploit-attempts-for-gpustack-authentication-bypass-cve-2026-102895-thu-nov-12th-f92924","Exploit Attempts for GPUStack Authentication Bypass (CVE-2026-102895), (Thu, Nov 12th)",[31,37],{"id":32,"name":33,"slug":34,"description":35,"color":36},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":38,"name":39,"slug":40,"description":41,"color":42},"af7fce9e-1ce8-4156-93bc-09dcfbfdf29d","Patch Management","patch-management","Unpatched vulnerabilities, delayed updates","#ef4444",[],[45,49,52],{"slug":46,"name":47,"problem":48},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",{"slug":40,"name":50,"problem":51},"Automated patch management","Known holes get closed in days, not months.",{"slug":53,"name":54,"problem":55},"firewall","Next-generation firewall and intrusion prevention","Malicious traffic is blocked at the network edge and between zones."]